Security headers are the cheapest hardening a website can get: a handful of response headers that tell the browser to stay on HTTPS, refuse to run injected scripts, refuse to be framed by another site and stop guessing content types. They're also easy to forget, and they quietly disappear when someone swaps a CDN, a load balancer or a framework.

Checking one site by hand is fine ( curl -sI https://example.com ). Checking a client list, every subdomain you own, or a few hundred prospects isn't. This post builds one script that takes a list of URLs and returns, for each one, the final URL after redirects, an A-F grade, a 0-100 score and a plain-English list of what's missing.

What the script checks

Header Points What "good" looks like

Strict-Transport-Security 25 max-age of at least 180 days

Content-Security-Policy 25 restricts scripts ( script-src or default-src ); minus points for 'unsafe-inline' without a nonce or hash, and for 'unsafe-eval'

Clickjacking 15 X-Frame-Options or CSP…